ABI guarantee for auditd

hsultan
2015-01-15T20:24:39Z

Hi,

Sorry for the deluge of questions :)

Regarding auditd, what is the ABI guarantee ? Do you guarantee that the
text contained in audit_reply->msg.data will always be the same format ?
I imagine you reserve the right to add fields, but how about removing
any or even reordering them ?

Or are people simply required to use auparse to guarantee they get
records properly ?

Also, regarding 'unofficial' ABI compatibility, when has the
audit_reply->msg.data format changed last ? Say these past 3-4 years,
were there any changes in the format or could I use a faster, but
specifically focused parser on the msgs when detecting older releases at
least ?

Thanks,

Hassan